Question

I’m trying to switch form $_REQUEST to $_POST, as it is more secure.
I have the following code in my server.php:

    if (isset($_REQUEST['mode']) && $_REQUEST['mode']=='verwijderturf'){
    $sql="SELECT * FROM users WHERE Naam='".cleanInput($_REQUEST['naam'])."'";
    $result=mysql_query($sql);
    $count=mysql_num_rows($result);
    if($count > 0){
        $date2 = date("Y-m-d");
        $naam2 = cleanInput($_REQUEST['naam']);
        $door = cleanInput($_REQUEST['door']);
        mysql_query("INSERT INTO turfjes 
                     VALUES (
                             'Adtje', 
                             '".$naam2."',
                             '', 
                             '".$date2."',
                             '".$door."')") 
        or die (mysql_error());
    }
}

Which works perfectly.
However, when I switch all $_REQUEST’s to $_POST my server.php does not do anything…

I’m using ajax requests to send data to my server.
For example:

function verwijderturf() {
    var naam = $("naam").value;
    $("naamnieuw").value = "";
    $("naam").value = "";
    $("redennieuw").value = "";
    new Ajax.Request('server.php?mode=verwijderturf&naam='+naam+'&door='+$("door2").value,{
        method: 'post', 
        onSuccess: update,
        onFailure: ajaxFailure
    });
}

As you can see, my ajax methode is ‘post’, so it should work just fine with $_POST.

Can anyone help me please?
Thanks in advance.

Answer 1

You need to provide the parameters as POST parameters, not GET. Which Javascript library are you using?

I.e. for jQuery it would be

jQuery.ajax('server.php',{
    data: {
        'mode': 'verwijderturf',
        'naam': naam,
        'door': $("door2").value
    },
    type: 'post', 
    success: update,
    error: ajaxFailure
});

Example for Prototype:

new Ajax.Request('server.php',{
    parameters: {
        'mode': 'verwijderturf',
        'naam': naam,
        'door': $("door2").value
    },
    method: 'post', 
    onSuccess: update,
    onFailure: ajaxFailure
});

data (jQuery) and parameters (Prototype) is a key/value object and represents all POST parameters. In both librarys this could be a serialized string, like 'key=value&key2=value' but i prefer to use an object and let the library serialize them.